Lucene search

HackeroneCVE-2024-39715

HistorySep 07, 2024 - 5:15 p.m.

CVE-2024-39715

2024-09-0717:15:12

CWE-94

hackerone

web.nvd.nist.gov

code injection

remote file upload

remote code execution

rest api access

vspc server

CVSS3

8.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

8.2

Confidence

Low

EPSS

Percentile

9.5%

JSON

A code injection vulnerability that allows a low-privileged user with REST API access granted to remotely upload arbitrary files to the VSPC server using REST API, leading to remote code execution on VSPC server.

Affected configurations

Vulnrichment

Node

veeamservice_provider_consoleRange≤8.0.0.19552

VendorProductVersionCPE
veeamservice_provider_console*cpe:2.3:a:veeam:service_provider_console:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
veeam	service_provider_console	*	cpe:2.3:a:veeam:service_provider_console::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "vendor": "Veeam",
    "product": "Veeam Service Provider Console",
    "versions": [
      {
        "version": "8",
        "status": "affected",
        "lessThanOrEqual": "8",
        "versionType": "semver"
      }
    ]
  }
]

References

www.veeam.com/kb4649

Social References

CVSS3

8.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

8.2

Confidence

Low

EPSS

Percentile

9.5%

JSON

Related for CVE-2024-39715